MAL-2024-9067 Malicious code in website-scanner (PyPI)
- Package
- website-scanner
- Registry
- PyPI
What is MAL-2024-9067?
MAL-2024-9067 is a malicious package in website-scanner, published on 1 Oct 2024.
Official description
The obfuscated code in setup.py on installation collects information about the system (all possible about hardware, available resources, IP, names, etc.) and sends to a telegram webhook.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-website-scanner
Reasons (based on the campaign):
exfiltration-generic
obfuscation
A Telegram webhook is used to send collected data.
The OpenSSF Package Analysis project identified 'website-scanner' @ 1.0.0 (pypi) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
What should I do about MAL-2024-9067?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.